One known problem when monitoring network activity is that of distinguishing between normal network activity and abnormal network activity. Short-term network activity might represent abnormal activity, might represent a change in normal network activity, or might represent a short-term deviation from normal activity that is itself not problematic. This has the effect that it might become difficult for a network monitoring device to reliably distinguish between those types of network activity that are normal and those types of network activity that are not.
Another known problem is when monitoring network traffic for a relatively large network, the amount of information relating to that network traffic can also be relatively large, with the effect that it might become difficult for a network monitoring device to maintain all of that relatively large amount of information within a reasonable amount of accessible memory.